initial commit

plan/02-caddy.md

@@ -0,0 +1,69 @@
+# Caddy — ingress, local CDN, landing page
+
+## Summary
+
+Single HTTP ingress for the stack. Three roles:
+1. **Reverse proxy** — `auth.ulicraft.local` → drasl.
+2. **Local CDN / static** — `packwiz.ulicraft.local` serves pack metadata AND the
+   mirrored mod jars (offline installs).
+3. **Landing page** — apex `ulicraft.local` serves launcher downloads + guest guide.
+
+Plain `:80` for now (LAN). TLS via step-ca deferred. Image: `caddy:alpine`.
+Caddy natively reads `{$BASE_DOMAIN}` env placeholders — no template render needed.
+
+## Network aliases (internal resolution)
+
+```yaml
+caddy:
+  networks:
+    mcnet:
+      aliases:
+        - "auth.${BASE_DOMAIN}"
+        - "packwiz.${BASE_DOMAIN}"
+```
+Lets `minecraft` reach `http://auth.ulicraft.local/authlib-injector` and
+`http://packwiz.ulicraft.local/pack.toml` without dnsmasq.
+
+## Caddyfile sketch
+
+```
+{
+	auto_https off
+}
+
+http://{$BASE_DOMAIN} {
+	root * /srv/www
+	file_server
+}
+
+http://auth.{$BASE_DOMAIN} {
+	reverse_proxy drasl:25585
+}
+
+http://packwiz.{$BASE_DOMAIN} {
+	root * /srv/pack
+	file_server browse
+}
+```
+
+Mounts: `./www:/srv/www:ro`, `./pack:/srv/pack:ro`, `./mirror/launcher:/srv/www/launcher:ro`.
+
+## Notes / risks
+
+- drasl behind a proxy: docs don't detail `X-Forwarded-*` trust. On plain HTTP LAN
+  with matching `BaseURL` it should be fine; revisit when TLS is added.
+- `file_server browse` gives a directory listing — handy for debugging the pack.
+- Mod-jar mirror lives under `/srv/pack/mods/` so packwiz URLs and jars share host.
+
+## Tasks
+
+- [ ] Add `caddy` service to `docker-compose.yml`, ports `80:80` (+`443` later)
+- [ ] Pass `BASE_DOMAIN` into caddy env
+- [ ] Create `caddy/Caddyfile` with apex + auth + packwiz vhosts
+- [ ] Add network aliases for `auth.` and `packwiz.` subdomains
+- [ ] Mount `./www`, `./pack`, `./mirror/launcher`
+- [ ] Confirm reverse_proxy to drasl works (auth web UI loads, Yggdrasil API responds)
+- [ ] Verify internal alias resolution from `minecraft` container (curl pack.toml)
+- [ ] Air-gap mirror: add per-host `tls internal` vhosts + aliases + mounts (see 11)
+- [ ] Export Caddy root CA for guest trust (LAN-party TLS = `tls internal`; step-ca deferred)
+- [ ] Defer (reminder): graduate `tls internal` → step-ca for persistent homelab